cbf00275e8
FEAT(security): enable HA with replica 2 and soft anti-affinity
...
- Add replicaCount: 2 to authelia, external-secrets, falco
- Add soft pod anti-affinity for node distribution
- Configure affinity for all security components
2026-01-08 13:07:56 +09:00
5e161fca8a
FEAT(external-secrets): add ClusterExternalSecret for Zot
...
- Add zot-registry-credentials ClusterExternalSecret
- Auto-create dockerconfigjson in labeled namespaces
- API version v1 (v1beta1 deprecated)
2026-01-07 14:28:58 +09:00
7cdc4f1e9e
FIX(external-secrets): disable CRD installation via Helm
...
- Set installCRDs: false to avoid annotation size limit
- CRDs already installed, manual upgrade when needed
2026-01-07 01:24:07 +09:00
661659acdb
FIX(external-secrets): ignore CRD status in diff
...
- Add /status to ignoreDifferences for CRDs
- Fix comparison error with terminatingReplicas field
2026-01-07 01:20:02 +09:00
3ea8b0d7c9
REVERT(external-secrets): remove ServerSideApply
...
- ServerSideApply causes schema compatibility issues
- Removed annotations directly from CRDs instead
2026-01-07 01:18:44 +09:00
835395f7ec
FIX(external-secrets): add ServerSideApply for CRD sync
...
- Fix CRD annotation size limit exceeded error
- ServerSideApply avoids last-applied-configuration annotation
2026-01-07 01:15:03 +09:00
321685822f
REFACTOR(repo): security repo structure
...
- Add application.yaml for ArgoCD app-of-apps
- Add kustomization.yaml with security components
- Add renovate.json for automated updates
- Update all component argocd.yaml repoURLs to security repo
Components: authelia, vault, external-secrets, falco, trivy
2026-01-05 00:40:26 +09:00
9822441e38
REFACTOR(repo): migrate repoURL to K3S-HOME
...
- Update repository URL to K3S-HOME organization
- Change from personal to organization repo
2026-01-05 00:40:26 +09:00
4e4be3109a
FIX(external-secrets): fix ESO CRD OutOfSync
...
- Add ignoreDifferences for CRD caBundle and spec/versions
- Add RespectIgnoreDifferences syncOption
- Prevents ArgoCD from detecting drift on CRD fields managed by webhook
2026-01-05 00:40:26 +09:00
renovate[bot]
8fd3daa65f
CHORE(external-secrets): update ESO to v1.2.1
...
- Upgrade External Secrets Operator chart
- Apply dependency updates
2026-01-05 00:40:26 +09:00
d392bbc57a
REFACTOR(argocd): remove serversideapply
...
- from argocd applications
- Fixes OutOfSync issues caused by operator-added default values
- ServerSideApply causes stricter field management that conflicts with
CRD defaults
2026-01-04 23:41:39 +09:00
fe484fb4a1
FEAT(external-secrets): add ServerSideApply=true to ESO
...
- Enable ServerSideApply for External Secrets Operator
- Fix CRD management
2026-01-04 23:41:39 +09:00
0a8c4bde16
REFACTOR(gitea): migrate repoURL from Gitea to GitHub
...
- Update repository URL to GitHub
- Change source control provider
2026-01-04 23:41:39 +09:00
970b69cedc
CHORE(deps): upgrade ESO to 1.2.0 for v1 API support
...
- Upgrade External Secrets Operator
- Enable v1 API support
2026-01-04 23:41:39 +09:00
a2682e292b
REFACTOR(goldilocks): use managedNamespaceMetadata for namespace labels
...
- Remove namespace.yaml files
- Add managedNamespaceMetadata with Goldilocks label
- Set CreateNamespace=true in syncOptions
- Update kustomization.yaml to remove namespace.yaml references
2026-01-04 23:41:39 +09:00
7653a33ffa
CHORE(repo): clean kustomization files
...
- Remove unused entries from kustomization
- Clean up configuration
2026-01-04 23:41:39 +09:00
ae8414f459
FIX(argocd): helm valueFiles paths in ArgoCD
...
- Applications
- Update valueFiles paths from helm-values/<app>.yaml to helm-
values.yaml
- Fixes ComparisonError after folder restructuring
Applications fixed:
- cert-manager
- cnpg
- external-secrets
- vault
- vpa
- velero
2026-01-04 23:41:39 +09:00
34a1c9f783
REFACTOR(repo): restructure infra folder structure
...
- Remove argocd/, helm-values/, ingress/ subdirectories
- Move files to parent directory with standardized names
- Add namespace.yaml to all apps with Goldilocks labels
- Preserve vault/ subdirectories (falco, velero)
- Update main kustomization.yaml to reference argocd.yaml files directly
- Comment out argocd.yaml in each app's kustomization.yaml to prevent
circular reference
Applications restructured:
- cert-manager (2 ArgoCD apps)
- external-secrets
- reloader
- vault (2 ArgoCD apps)
- velero (2 ArgoCD apps)
- falco
- cnpg
- haproxy
- metallb
- vpa
- argocd
2026-01-04 23:41:39 +09:00
861a5e97d7
PERF(grafana): optimize cpu requests based on
...
- actual usage from grafa...
- external-secrets: 20m → 5m (actual: 1m)
- external-secrets-webhook: 10m → 2m (actual: 1m)
- external-secrets-cert: 10m → 2m (actual: 1m)
- cnpg: 100m → 5m (actual: 2m)
- haproxy-ingress: 100m → 15m (actual: 9-10m)
2026-01-04 23:41:39 +09:00
100b7be198
REFACTOR(resources): remove cpu limits
...
- to prevent throttling
Removed CPU limits from all infrastructure components while keeping
memory limits for protection:
- cnpg: removed 500m CPU limit
- external-secrets: removed 200m, 100m CPU limits (operator, webhook,
certController)
- falco: removed 500m CPU limit (falcosidekick webui)
- vault: removed 500m CPU limit
- velero: removed 500m, 1000m CPU limits (server, node-agent)
Benefits:
- ✅ Prevents CPU throttling
- ✅ Better performance and lower latency
- ✅ More efficient resource utilization
- ✅ Simpler management (only requests to tune)
Memory limits are kept to prevent memory leaks and OOM issues.
2026-01-04 23:41:39 +09:00
05a5de7c0f
CHORE(argocd): update ArgoCD applications to point to cluster-infrastructure
...
- Update repoURL to cluster-infrastructure repo
- Change source repository reference
2025-12-17 15:12:46 +09:00
2a89801d5e
INIT(repo): cluster infrastructure setup
2025-12-17 15:04:56 +09:00
